Linus Rath
45a4db1c22
fix: pin JMAP auth verification to configured server URL #237
2026-04-30 15:34:14 +02:00
Linus Rath
8935b81f12
chore: update version to 1.5.3
2026-04-28 17:34:06 +02:00
Linus Rath
dafc8ace3c
feat: track unique logins
2026-04-28 08:19:46 +02:00
Linus Rath
90acf181f3
fix: harden plugin config, TOTP token exchange, and branding file serving
2026-04-28 01:44:37 +02:00
Linus Rath
da103ff06f
feat: implement OAuth auto-setup functionality for Stalwart integration
2026-04-25 01:37:18 +02:00
Linus Rath
8bdadc7ba3
fix: standardize punctuation
2026-04-16 19:07:42 +02:00
Pascal Dietrich and Linus Rath
f9052eb23f
feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars
2026-04-09 22:13:08 +02:00
Linus Rath
aa40c8be26
fix: harden proxy auth and SSRF defenses
2026-03-31 17:47:09 +02:00
Linus Rath
66fe7fd359
fix: enhance security by blocking plugins with dangerous JS patterns and enforcing strict session secret length
2026-03-31 15:56:32 +02:00
Linus Rath
5da0e2bdf1
fix: patch critical auth bypass and credential leak vulnerabilities
2026-03-31 00:46:15 +02:00
Linus Rath
67210c9924
fix: handle 2FA/TOTP session expiry with basic auth #117
2026-03-30 16:37:07 +02:00
Linus Rath
83a0a1e235
feat: add non-interactive SSO login flow for embedded/iframe deployments ( closes #69 )
2026-03-21 20:45:19 +01:00
Linus Rath
d493bb17dc
feat: implement account switcher component and state management
...
- Add AccountSwitcher component for managing user accounts with UI for switching, adding, and logging out.
- Create account state manager to handle snapshots of account-specific states for efficient switching.
- Introduce utility functions for account management, including ID generation and avatar color assignment.
- Implement Zustand store for account management, supporting addition, removal, and state retrieval of accounts.
2026-03-19 10:08:57 +01:00
Linus Rath
b090bf6d52
feat: add support for OAuth-only login mode and update configuration handling
2026-03-12 22:05:29 +01:00
Matthieu MALVACHE and Matthieu MALVACHE
1b0e3e41c6
feat: add "Remember me" session persistence and simplify 2FA UX
2026-02-26 00:47:53 +01:00
Matthieu MALVACHE and Matthieu MALVACHE
7b6b8fc132
feat(auth): add RP-initiated logout and OAuth unit tests
...
OAuth logout now terminates the IdP session via end_session_endpoint
with HTTPS-only URL validation. Adds 14 unit tests for PKCE and
OAuth discovery.
2026-02-26 00:08:57 +01:00
Matthieu MALVACHE and Matthieu MALVACHE
ec06b0c494
feat: add OAuth2/OIDC with PKCE for SSO login
...
Add opt-in SSO authentication alongside Basic Auth. OAuth endpoints are
auto-discovered via .well-known, with support for external IdPs
(Keycloak, Authentik) via configurable OAUTH_ISSUER_URL. Sessions
persist through httpOnly refresh token cookies with automatic renewal.
2026-02-25 23:41:37 +01:00
Linus Rath